Orionix03/mlx-gguf-oob-poc

Security research PoC — Apple MLX GGUF loader memory-safety issue

Coordinated disclosure. This repository hosts proof-of-concept model files for a memory-safety vulnerability reported privately through huntr's Model File Vulnerability program. Published for defensive security research only and must not be used maliciously.

What this is

• Component: ml-explore/mlx — GGUF loader (mlx/io/gguf.cpp, bundled gguf-tools).
• Class: out-of-bounds read (CWE-125) reachable when loading an untrusted .gguf model via the documented public API mlx.core.load("*.gguf"), at model-load time.
• Demonstrated impact: deterministic crash / denial-of-service, confirmed with AddressSanitizer across 7 distinct loader sinks (metadata key + value, tensor name, tensor data, quantized tensor data). The metadata-value/key path is distinct from CVE-2025-62608 and CVE-2025-62609; the tensor-data sink is an incomplete fix of CVE-2025-62609. No out-of-bounds write, memory corruption, or RCE is claimed.

Files

File	Purpose
evil_array_f32.gguf, evil_string.gguf, evil_string_array.gguf	metadata-value OOB-read PoCs
deep_keyname.gguf, deep_tensorname.gguf, deep_tensordata.gguf, deep_quant_q40.gguf	additional same-root sinks
craft.py, craft_deep.py	regenerate the PoC files (Python stdlib only)
asan_*.txt	AddressSanitizer traces (exact source attribution)
suggested-fix.diff, fix_verified.txt	proposed fix + verification transcript

Reproduce

python3 -m venv venv && ./venv/bin/pip install mlx     # mlx 0.31.2
python3 craft.py
./venv/bin/python -c "import mlx.core as mx; mx.load('evil_array_f32.gguf')"   # crash

Responsible use

These files only cause a memory-safety fault in MLX's GGUF parser. Do not load untrusted model files in production. Questions: via the huntr report thread.

Researcher: Orionix (huntr: Orionix03). Reported under coordinated disclosure.